CVE-2026-89662: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89662 Overview

CVE-2026-89662 is a use-after-free vulnerability in the Linux kernel's NFS server (NFSD) subsystem. The flaw occurs during NFS client teardown when __destroy_client() releases a client's open owners but leaves lock owners referenced only by blocked locks on cl_ownerstr_hashtbl. A race between __destroy_client() and the per-net laundromat, which reaps blocked locks from nn->blocked_locks_lru independently of client state, causes the laundromat to free a lock owner while __destroy_client() dereferences it. The result is a NULL pointer dereference in remove_blocked_locks() and a potential use-after-free condition affecting kernel stability and integrity.

Critical Impact
A race condition in NFSD client teardown enables use-after-free on lock owner structures, potentially leading to kernel memory corruption or denial of service on NFS servers.

Affected Products

Linux kernel NFSD (NFS server) subsystem
Multiple stable kernel branches (see upstream commits for patched versions)
Distributions shipping vulnerable kernels providing NFS server functionality

Discovery Timeline

2026-09-11 - CVE-2026-89662 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89662

Vulnerability Analysis

The vulnerability resides in the NFSD client destruction path. When an NFS client issues a DESTROY_CLIENTID operation, the server invokes __destroy_client() to release the client's state. This function walks cl_ownerstr_hashtbl and calls remove_blocked_locks() on each lock owner without first taking a reference on the owner.

The function client_has_state() does not count a bare lock owner whose only reference is a blocked lock (nbl). Consequently, DESTROY_CLIENTID can reach __destroy_client() even when such bare owners remain in the hash table. Freeing a blocked lock drops the owner reference held via flc_owner, so once the laundromat frees the blocked lock, the owner's refcount can hit zero.

The per-net laundromat reaps blocked locks from nn->blocked_locks_lru on its own schedule, without coordinating with client teardown. The two code paths share blocked_locks_lock only for the list splice operation, not for the lock owner's lifetime.

Root Cause

The root cause is inadequate reference counting and locking discipline across two concurrent paths that manipulate the same lock owner objects. nfsd4_release_lockowner() correctly holds a reference across the call, but __destroy_client() does not, creating a window where the laundromat can free the owner mid-dereference.

Attack Vector

An NFSv4 client that can trigger DESTROY_CLIENTID while blocked locks associated with bare lock owners exist on the server can race the laundromat to trigger the use-after-free. The attack requires network reachability to the NFS server and the ability to open files and request byte-range locks that block, followed by client destruction. The upstream fix holds cl_lock across the hash table walk, takes a reference and unhashes each owner, then drops cl_lock before calling remove_blocked_locks() and nfs4_put_stateowner().

See the kernel commits linked below for the exact patch. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-89662

Indicators of Compromise

Kernel oops or NULL pointer dereference traces referencing remove_blocked_locks, nfs4_put_stateowner, or __destroy_client in dmesg or the system journal
Unexpected NFS server crashes or soft lockups correlated with client session teardown activity
KASAN reports flagging use-after-free on nfs4_lockowner structures on kernels built with sanitizers enabled

Detection Strategies

Monitor kernel ring buffer output for stack traces implicating NFSD lock owner handling functions
Enable KASAN in test environments to surface use-after-free conditions during NFS workload testing
Correlate NFSv4 DESTROY_CLIENTID operations with kernel fault events to identify race exploitation attempts

Monitoring Recommendations

Ingest kernel logs and NFSD audit events into a centralized logging platform for anomaly analysis
Track NFS server availability metrics to detect crash-loop patterns consistent with kernel faults
Alert on repeated NFSv4 client session teardowns from the same source within short time windows

How to Mitigate CVE-2026-89662

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the commits 1ce74d1b, 42d7954b, 4804c58f, 5e2fa29d, 8cf4ff0a, a6ead6ff, b8bad5a1, and bb38ff8b
Update to distribution kernel packages that incorporate the NFSD lock owner reference-counting fix
Restrict NFS server exposure to trusted network segments until patched kernels are deployed

Patch Information

The fix modifies __destroy_client() to hold cl_lock across the walk of cl_ownerstr_hashtbl, take a reference on each owner, and unhash it before dropping cl_lock. The reference is then released after remove_blocked_locks() and nfs4_put_stateowner() complete. Patches are available via the kernel.org stable tree: Kernel Commit 1ce74d1b, Kernel Commit 42d7954b, Kernel Commit 4804c58f, Kernel Commit 5e2fa29d, Kernel Commit 8cf4ff0a, Kernel Commit a6ead6ff, Kernel Commit b8bad5a1, and Kernel Commit bb38ff8b.

Workarounds

Disable the NFS server (nfsd) on hosts that do not require NFSv4 export functionality
Use firewall rules to limit access to TCP/UDP port 2049 to trusted client subnets
Prefer NFSv3 exports where feasible, since the vulnerable code path is specific to NFSv4 lock owner handling

bash

# Verify running kernel and restrict NFS exposure until patched
uname -r
systemctl status nfs-server

# Example firewall restriction to trusted subnet
sudo iptables -A INPUT -p tcp --dport 2049 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 2049 -j DROP